Re: [WEB SECURITY] Re: SECNICHE : Dwelling Security is On the Run

["James Landis" <jcl24 () cornell edu>]

While I generally agree with your assessment of the self-aggrandizing
nature of Aditya's posts, I would argue that "Double Trap" XSS is at
least academically interesting. It can defeat even a perfect filter
designed to catch only a single valid instance of script tags in user
input.

I say academically because attempting to do input filtering to stop
XSS is a horrible approach; anyone attempting to write input filters
to catch the infinite permutations of executable markup and myriad
encodings thereof is wasting his time.

-j

On 6/15/07, Michal Zalewski <lcamtuf () dione ids pl> wrote:
> On Tue, 12 Jun 2007 dcdave () att net wrote:
>
> > In an admittedly brief review of this page, I saw nothing useful or
> > informative to my career in information assurance.
>
> Aditya has a history of using security mailing lists to advertise
> his various security consulting projects (metaeye.org, etc) under the
> guise of fairly bogus whitepapers and vulnerability reports:
>
> http://portal.spidynamics.com/blogs/jeff/archive/2007/04/16/ASP.NET-encoding-shortcomings-_2800_review-of-MetaEye-analysis_2900_.aspx
> http://www.webappsec.org/lists/websecurity/archive/2007-03/msg00079.html
> http://www.webappsec.org/lists/websecurity/archive/2007-03/msg00115.html
>
> As a rule, these claim to discuss cutting-edge attack techniques whilist
> in fact describing something remarkably mundane (register_globals as
> "Global Space Exploitation", form-based XSS as "Double Trap Attacks").
>
> I would advise WEBSECURITY moderators to exercise... well, moderation in
> approving his non-advisory posts:
>
> http://www.webappsec.org/lists/websecurity/archive/2007-06/msg00010.html
> http://www.webappsec.org/lists/websecurity/archive/2007-06/msg00019.html
>
> /mz
>
>
> ----------------------------------------------------------------------------
> Join us on IRC: irc.freenode.net #webappsec
>
> Have a question? Search The Web Security Mailing List Archives:
> http://www.webappsec.org/lists/websecurity/
>
> Subscribe via RSS:
> http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/